@danielblomma/cortex-mcp 2.4.0 → 2.4.2

package/scaffold/mcp/tests/project-service-registry.test.mjs

@@ -0,0 +1,172 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+import {
+  normalizeProjectCwd,
+  ProjectServiceRegistry,
+} from "../dist/daemon/project-service-registry.js";
+
+function makeProject() {
+  const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-daemon-project-"));
+  fs.mkdirSync(path.join(cwd, ".context"));
+  return cwd;
+}
+
+test("ProjectServiceRegistry: registers each normalized project exactly once", async () => {
+  const first = makeProject();
+  const second = makeProject();
+  const created = [];
+  const stopped = [];
+  const registry = new ProjectServiceRegistry((cwd) => {
+    created.push(cwd);
+    return [{
+      stop() {
+        stopped.push(cwd);
+      },
+    }];
+  });
+
+  try {
+    assert.equal(registry.register(first), true);
+    assert.equal(registry.register(path.join(first, ".")), false);
+    assert.equal(registry.register(second), true);
+    assert.equal(registry.size(), 2);
+    assert.deepEqual(
+      registry.projectCwds().sort(),
+      [fs.realpathSync(first), fs.realpathSync(second)].sort(),
+    );
+    assert.deepEqual(created.sort(), registry.projectCwds().sort());
+
+    await registry.stopAll();
+    assert.equal(registry.size(), 0);
+    assert.deepEqual(stopped.sort(), created.sort());
+  } finally {
+    fs.rmSync(first, { recursive: true, force: true });
+    fs.rmSync(second, { recursive: true, force: true });
+  }
+});
+
+test("ProjectServiceRegistry: ignores roots without a Cortex context directory", () => {
+  const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-daemon-project-"));
+  let factoryCalls = 0;
+  const registry = new ProjectServiceRegistry(() => {
+    factoryCalls += 1;
+    return [];
+  });
+
+  try {
+    assert.equal(registry.register(cwd), false);
+    assert.equal(registry.register(path.join(cwd, "missing")), false);
+    assert.equal(registry.register(""), false);
+    assert.equal(registry.size(), 0);
+    assert.equal(factoryCalls, 0);
+  } finally {
+    fs.rmSync(cwd, { recursive: true, force: true });
+  }
+});
+
+test("normalizeProjectCwd: returns a physical Cortex project root", () => {
+  const cwd = makeProject();
+  try {
+    assert.equal(
+      normalizeProjectCwd(path.join(cwd, ".")),
+      fs.realpathSync(cwd),
+    );
+    assert.equal(normalizeProjectCwd(path.join(cwd, "missing")), null);
+  } finally {
+    fs.rmSync(cwd, { recursive: true, force: true });
+  }
+});
+
+test("ProjectServiceRegistry: resolves project symlinks to one service identity", {
+  skip: process.platform === "win32",
+}, () => {
+  const cwd = makeProject();
+  const linkRoot = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-daemon-link-"));
+  const linked = path.join(linkRoot, "project");
+  fs.symlinkSync(cwd, linked, "dir");
+  const registry = new ProjectServiceRegistry(() => []);
+
+  try {
+    assert.equal(registry.register(linked), true);
+    assert.equal(registry.register(cwd), false);
+    assert.equal(registry.size(), 1);
+    assert.equal(registry.has(cwd), true);
+  } finally {
+    fs.rmSync(linkRoot, { recursive: true, force: true });
+    fs.rmSync(cwd, { recursive: true, force: true });
+  }
+});
+
+test("ProjectServiceRegistry: starts host-wide services once for projects sharing one Enterprise identity", async () => {
+  const first = makeProject();
+  const second = makeProject();
+  const hostStarts = [];
+  const projectStarts = [];
+  const registry = new ProjectServiceRegistry(
+    (cwd) => {
+      projectStarts.push(cwd);
+      return [];
+    },
+    {
+      credentialIdForCwd: () => "same-identity",
+      hostFactory: (cwd, credentialId) => {
+        hostStarts.push({ cwd, credentialId });
+        return [];
+      },
+    },
+  );
+
+  try {
+    assert.equal(registry.register(first), true);
+    assert.equal(registry.register(second), true);
+    assert.equal(hostStarts.length, 1);
+    assert.equal(hostStarts[0].cwd, fs.realpathSync(first));
+    assert.equal(hostStarts[0].credentialId, "same-identity");
+    assert.deepEqual(
+      projectStarts.sort(),
+      [fs.realpathSync(first), fs.realpathSync(second)].sort(),
+    );
+  } finally {
+    await registry.stopAll();
+    fs.rmSync(first, { recursive: true, force: true });
+    fs.rmSync(second, { recursive: true, force: true });
+  }
+});
+
+test("ProjectServiceRegistry: rejects a second Enterprise identity before starting project or host services", async () => {
+  const first = makeProject();
+  const second = makeProject();
+  let hostStarts = 0;
+  let projectStarts = 0;
+  const registry = new ProjectServiceRegistry(
+    () => {
+      projectStarts += 1;
+      return [];
+    },
+    {
+      credentialIdForCwd: (cwd) =>
+        cwd === fs.realpathSync(first) ? "identity-a" : "identity-b",
+      hostFactory: () => {
+        hostStarts += 1;
+        return [];
+      },
+    },
+  );
+
+  try {
+    assert.equal(registry.register(first), true);
+    assert.equal(registry.register(second), false);
+    assert.equal(registry.size(), 1);
+    assert.equal(hostStarts, 1);
+    assert.equal(projectStarts, 1);
+    assert.equal(registry.activeCredentialId(), "identity-a");
+  } finally {
+    await registry.stopAll();
+    fs.rmSync(first, { recursive: true, force: true });
+    fs.rmSync(second, { recursive: true, force: true });
+  }
+});

package/scaffold/mcp/tests/review-trust-contract.test.mjs

@@ -12,6 +12,10 @@ import {
   recordReviewDeliveryStatus,
 } from "../dist/enterprise/reviews/trust-state.js";
 import { syncedWorkflowsCachePath } from "../dist/core/workflow/synced-registry.js";
+import { enterpriseCredentialId } from "../dist/core/license.js";
+
+const ENTERPRISE_ENDPOINT = "https://licenses.example.com";
+const ENTERPRISE_KEY = "ent_review_contract_12345678";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const reviewFixture = JSON.parse(
@@ -25,6 +29,16 @@ function makeProject() {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), "cortex-review-contract-"));
   const contextDir = path.join(root, ".context");
   fs.mkdirSync(contextDir, { recursive: true });
+  fs.writeFileSync(
+    path.join(contextDir, "enterprise.yml"),
+    [
+      "enterprise:",
+      `  api_key: ${ENTERPRISE_KEY}`,
+      `  endpoint: ${ENTERPRISE_ENDPOINT}`,
+      "",
+    ].join("\n"),
+    "utf8",
+  );
   const taskDir = path.join(root, ".agents", "task-1");
   fs.mkdirSync(taskDir, { recursive: true });
   fs.writeFileSync(
@@ -49,6 +63,10 @@ function enableSyncedSecureBuild(homeDir) {
     syncedWorkflowsCachePath(syncedDir),
     JSON.stringify(
       {
+        credential_id: enterpriseCredentialId(
+          ENTERPRISE_ENDPOINT,
+          ENTERPRISE_KEY,
+        ),
         workflows: {
           "secure-build": {
             workflow_id: "secure-build",

package/scaffold/mcp/tests/secure-enterprise-endpoint.test.mjs

@@ -0,0 +1,46 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { isAllowedEnterpriseEndpoint } from "../dist/core/secure-endpoint.js";
+import { pushMetrics } from "../dist/enterprise/telemetry/sync.js";
+import { syncFromCloud } from "../dist/enterprise/policy/sync.js";
+
+test("Enterprise endpoint policy allows TLS and loopback HTTP only", () => {
+  assert.equal(isAllowedEnterpriseEndpoint("https://enterprise.example.com"), true);
+  assert.equal(isAllowedEnterpriseEndpoint("http://127.0.0.1:8787"), true);
+  assert.equal(isAllowedEnterpriseEndpoint("http://localhost:8787"), true);
+  assert.equal(isAllowedEnterpriseEndpoint("http://[::1]:8787"), true);
+  assert.equal(isAllowedEnterpriseEndpoint("http://external.example.com"), false);
+  assert.equal(
+    isAllowedEnterpriseEndpoint("https://user:pass@enterprise.example.com"),
+    false,
+  );
+});
+
+test("telemetry and policy send primitives reject external HTTP before attaching a bearer key", async () => {
+  let fetches = 0;
+  globalThis.fetch = async () => {
+    fetches += 1;
+    throw new Error("fetch must not be called");
+  };
+  try {
+    const telemetry = await pushMetrics(
+      {},
+      "http://external.example.com/telemetry",
+      "ent_secret_12345678",
+    );
+    assert.equal(telemetry.success, false);
+    assert.match(telemetry.error, /insecure or invalid/);
+
+    const policy = await syncFromCloud(
+      "http://external.example.com/policy",
+      "ent_secret_12345678",
+      {},
+    );
+    assert.equal(policy.success, false);
+    assert.match(policy.error, /insecure or invalid/);
+    assert.equal(fetches, 0);
+  } finally {
+    globalThis.fetch = undefined;
+  }
+});